Covered entity (HIPAA)
Also called HIPAA covered entity.
Under HIPAA, a health plan, a healthcare clearinghouse, or a healthcare provider that sends health information electronically in standard transactions.
Last updated
What it is.
45 CFR 160.103 lists three kinds of covered entity: health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in connection with a HIPAA transaction, such as billing insurance.
HIPAA applies to covered entities and to their business associates. A company that is neither, such as a fitness app people sign up for themselves, is usually outside HIPAA, though other rules such as the FTC Health Breach Notification Rule may apply.
Why it matters
Whether your customer is a covered entity decides whether the health data your software handles is PHI and whether you need a BAA. It is the first question in any health software project.
In a product build
Discovery for a health build starts by listing who the customers are. If any are covered entities, HIPAA safeguards are part of the scope from the first milestone, not added later.
Common mistakes.
- 01
Assuming every healthcare business is a covered entity. A cash-only provider that never bills electronically may not be.
- 02
Assuming HIPAA does not apply because your company is not a covered entity. Business associates are covered too.
- 03
Ignoring state privacy laws and the FTC rule when HIPAA does not apply.
Read the official text.
Primary sources this definition is based on.
- 45 CFR 160.103, Definitions (eCFR)checked 2026-10-25
- 16 CFR Part 318, FTC Health Breach Notification Rule (eCFR)checked 2026-10-25
Work it out with a tool.
Related terms.
- Business associate (HIPAA)A person or company that creates, receives, keeps or sends protected health information on behalf of a HIPAA covered entity.
- PHI (protected health information)Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate.
- BAA (business associate agreement)The contract HIPAA requires between a covered entity and a vendor that creates, receives, keeps or sends its PHI.
- ePHI (electronic protected health information)Protected health information that is stored or sent in electronic form, which is what the HIPAA Security Rule protects.
